Compliance
What we support, and what we do not claim.
ApexAI claims no certification on this site. This page says what the platform is designed to support, and leaves every certification status as a placeholder until it is real.
Certification status
Placeholders. A status is published only once an audit is complete and the report can be shared.
| Framework | Status | Note |
|---|---|---|
| ISO/IEC 27001 | [Status] | No certification is claimed. |
| SOC 2 | [Status] | No attestation report is claimed. |
| Decree 13/2023/ND-CP (Vietnam) | [Status] | A legal obligation of the data controller, not a certificate. See below. |
| GDPR | [Status] | Applies where you process personal data of people in the EU. |
| NIST Cybersecurity Framework | [Status] | [Mapping document — on request.] |
| FIPS 140-3 | [Status] | No validation of cryptographic modules is claimed. |
Vietnam’s Decree 13/2023/ND-CP on personal data protection
ApexAI is designed to help you meet the decree’s obligations; meeting them remains your organisation’s responsibility. [Legal review of this section — required before publication.]
Data stays in your environment
On-premise or private cloud; outbound connections only for security work.
Protected at the field
FHE, AES-256-GCM, blind index or hybrid ML-KEM before ETL, analytics or APIs read the data.
Minimise what flows
Mask or drop fields by policy before they leave the source.
Impact assessments and breaches
PIA and breach response in Govern; a control checks breaches are notified within 72 hours.
Least privilege, recorded
Just-in-time access, access reviews and a signed audit trail.
Where data lives
A sovereignty map of your data locations.
Autonomous Compliance: ten controls, read from the platform
Govern checks these on demand against what the platform holds, shows the figure that decided each, and names the requirement it speaks to (GDPR, Decree 13, ISO 27001, SOC 2, NIST). A control that cannot be read is “not assessed”, never assumed to pass.
- The audit trail shows no tampering
- Access reviews are decided within 30 days
- Privileged access is just-in-time and expires within 8 hours
- There are at least two active administrators
- The latest code scan finds no broken cryptography
- The cryptography inventory was refreshed within 30 days
- Breaches are notified within 72 hours
- SOC cases are resolved within target
- Monitoring received alerts in the last 24 hours
- Responders are notified outside the console
Ask for the current status and mappings.
We share what is real today, and what is in progress, with your risk and compliance team.